Jatin, Currently we're using TACACS+ for authentication.  We Here's a description of the requirement for 2 factor authentication: Id - NET0431 Vulnerability Discussion AAA network security services provide the primary framework through which a network administrator can set up access control on network points of entry or network access servers, which is usually the function of a router or access server. Authentication identifies a user; authorization determines what that user can do; and accounting monitors the network usage. Without AAA, unauthorized users may gain access and possibly control of the routers. If the router network is compromised, large portions of the network could be incapacitated with only a few commands. Default Finding Details AAA server does not redirect/call to a two-factor authentication server. NET Authentication Access Procedure: The implementation varies and a thorough review is necessary. Have the SA review and discuss their implementation. A typical AAA process includes the network system redirecting user access requests either directly to an ACE/Server or to a CiscoSecure ACS (TACACS+) server which redirects the 'authentication' request to the ACE/Server for strong authentication via user tokens (keyfobs). During the review have the SA point out the calls from the TACACS+ or Radius servers to the authentication server performing the two-factor requirement From my understanding ACS can meet this requirement, I just need some ideas or case studies to see how it how implemented. Stephanie ... View more

Kush, Can ACS be configured to do authentication via external DB first and fallback to the internal DB if the external DB is unavailble? Can ACS send and event/trap when an unknown user is discovered? Stephanie ... View more

That worked and so far I have no collectors with status "Source Not Responding".  Thanks for your help. I did change them via IPM->Collector Management->Devices by updating their credentials so what does this do since the strings are also stored in the DCR? Stephanie ... View more

I ran "pdterm IPMProcess" followed by "pdexec IPMProcess"  and now I'm getting this error: Error Error in communicating with IPMGroupAdministration Server. It may be down or not yet up. Please make sure that the IPMGroupAdministration Server is up and running, then refresh the page. Stephanie ... View more

Ok, thanks. I'm still a little confused.  Originally I had 254 collectors with status "Source Not Responding".  I went to IPM->Collector Management->Devices->All Devices to select my device and afterwards selected Edit Device Credentials to update the strings.  Afterwards I selected the collectors and selected Reconfigure.  I ended up with 26 collectors left with status "Source Not Responding". How can I see which strings IPM is using? Stephanie ... View more

crypto key generate rsa general-keys modulus 2048 I don't see "general-keys modulus" in your output so I'm assuming "general-keys modulus" will be omitted in the configuration. So there's no NetConfig template which will push this exact command: "crypto key generate rsa general-keys modulus 2048" Stephanie ... View more